News
ClamAV Multiple Denial of Service Vulnerabilities
- Details
- Category: Security
- Published: Wednesday, 22 August 2007 22:28
1) A NULL-pointer dereference error exists within the "cli_scanrtf()" function in libclamav/rtf.c. This can potentially be exploited to crash ClamAV via a specially crafted RTF file.
2) A NULL-pointer dereference error exists within the "cli_html_normalise()" function in libclamav/htmlnorm.c. This can potentially be exploited to crash ClamAV via a specially crafted HTML file containing a "data" URL scheme.
The vulnerabilities are reported in versions prior to 0.91.2.
The recomendation is to update to version 0.91.2.
The original advisory can be found at ClamAV project page .